CVE-2025-68861CWE-862broken-access-control

CVE-2025-68861

High · published December 29, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

⚡ A missing authorization check in the Plugin Optimizer could let anyone access restricted features! 🤯 Think of this as a restaurant where the kitchen door is wide open — any customer can waltz in and access the secret recipe stash without a password. This lack of access control is a serious oversight! An attacker could exploit this vulnerability to manipulate settings or access sensitive data, potentially putting your website at risk. This could lead to unauthorized changes that affect not just performance but also security, making it a critical concern!

Put simply

Think of this as a restaurant where the kitchen door is wide open — any customer can waltz in and access the secret recipe stash without a password. This lack of access control is a serious oversight! This vulnerability in the Plugin Optimizer allows unauthorized users to bypass access controls, leading to the exploitation of incorrectly configured security levels.

What to do

An attacker could exploit this vulnerability to manipulate settings or access sensitive data, potentially putting your website at risk. This could lead to unauthorized changes that affect not just performance but also security, making it a critical concern! Update the Plugin Optimizer to version 1.3.7 or higher to close this gap. Additionally, review your access control settings to ensure they are correctly configured and secure. Regularly audit your plugins for any further vulnerabilities! You've got this! With these steps, you can keep your site secure and confidently in control! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-29T23:15Z
References (1)
EPSS history
Timeline
  • 29 DEC 17:23Z
    WordPress Plugin Optimizer plugin <= 1.3.7 - Broken Access Control vulnerability
    cvelistv5